Blame SOURCES/0432-commands-menuentry-Fix-quoting-in-setparams_prefix.patch

468bd4
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
468bd4
From: Daniel Axtens <dja@axtens.net>
468bd4
Date: Fri, 22 Jan 2021 17:10:48 +1100
468bd4
Subject: [PATCH] commands/menuentry: Fix quoting in setparams_prefix()
468bd4
468bd4
Commit 9acdcbf32542 (use single quotes in menuentry setparams command)
468bd4
says that expressing a quoted single quote will require 3 characters. It
468bd4
actually requires (and always did require!) 4 characters:
468bd4
468bd4
  str: a'b => a'\''b
468bd4
  len:  3  => 6 (2 for the letters + 4 for the quote)
468bd4
468bd4
This leads to not allocating enough memory and thus out of bounds writes
468bd4
that have been observed to cause heap corruption.
468bd4
468bd4
Allocate 4 bytes for each single quote.
468bd4
468bd4
Commit 22e7dbb2bb81 (Fix quoting in legacy parser.) does the same
468bd4
quoting, but it adds 3 as extra overhead on top of the single byte that
468bd4
the quote already needs. So it's correct.
468bd4
468bd4
Fixes: CVE-2021-20233
468bd4
Fixes: 9acdcbf32542 (use single quotes in menuentry setparams command)
468bd4
468bd4
Signed-off-by: Daniel Axtens <dja@axtens.net>
468bd4
Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>
468bd4
---
468bd4
 grub-core/commands/menuentry.c | 2 +-
468bd4
 1 file changed, 1 insertion(+), 1 deletion(-)
468bd4
468bd4
diff --git a/grub-core/commands/menuentry.c b/grub-core/commands/menuentry.c
468bd4
index 4b5fcf2ce9a..7a533b9741b 100644
468bd4
--- a/grub-core/commands/menuentry.c
468bd4
+++ b/grub-core/commands/menuentry.c
468bd4
@@ -239,7 +239,7 @@ setparams_prefix (int argc, char **args)
468bd4
       len += 3; /* 3 = 1 space + 2 quotes */
468bd4
       p = args[i];
468bd4
       while (*p)
468bd4
-	len += (*p++ == '\'' ? 3 : 1);
468bd4
+	len += (*p++ == '\'' ? 4 : 1);
468bd4
     }
468bd4
 
468bd4
   result = grub_malloc (len + 2);